Author Topic: NASA class MMOD as primary threat to commercial crew vehicles  (Read 34073 times)

Online ChrisWilson68

  • Senior Member
  • *****
  • Posts: 3814
  • Sunnyvale, CA
  • Liked: 2460
  • Likes Given: 3192
I have to agree with Robotbeat.

This is just another example of NASA's long history of failing to adequately weight the "unknown unknowns" when doing risk assessment.  The risk of some other failure mode being far more likely than expected in new vehicles dwarfs the risk of MMOD.  For NASA to claim otherwise just makes them look foolish.

The risk of "unknown unknowns" is very hard to quantify.  That means when you pay people to spend a lot of time to calculate risks, they focus on the risks that they can quantify and tend to neglect the hard-to-quantify risks, unless they're really smart or trained in such pitfalls.  Even then, who wants to say to their boss the answer is "I don't know" when they're being paid to give specific numbers?

Offline baldusi

  • Senior Member
  • *****
  • Posts: 7437
  • Buenos Aires, Argentina
  • Liked: 1447
  • Likes Given: 4506
Are you aware that you are talking about the people who actually wrote the book on handling risk in scenarios of uncertainty?

Offline Robotbeat

  • Senior Member
  • *****
  • Posts: 28616
  • Minnesota
  • Liked: 8585
  • Likes Given: 5598
...

If you read the ASAP report that drove this article, the total mention of MMOD amounts to less than a paragraph.  This thread is getting wrapped around the axle on assumptions and incomplete/outdated information.  That something is the "primary" threat does not mean the threat is "large."  It just means that other identified and controlled threats are "smaller".
touche
Chris  Whoever loves correction loves knowledge, but he who hates reproof is stupid.

To the maximum extent practicable, the Federal Government shall plan missions to accommodate the space transportation services capabilities of United States commercial providers. US law http://goo.gl/YZYNt0

Offline bstrong

  • Full Member
  • ***
  • Posts: 394
  • Liked: 493
  • Likes Given: 333
Is any effort made to detect MMOD impacts from accelerometer data? Sounds like a tractable problem to me.

Online SWGlassPit

  • I break space hardware
  • Full Member
  • ****
  • Posts: 560
  • Liked: 409
  • Likes Given: 61
Most impacting particles weigh only milligrams. The resulting change in momentum would be virtually indistinguishable from instrumentation noise.

Offline woods170

  • IRAS fan
  • Senior Member
  • *****
  • Posts: 8686
  • IRAS fan
  • The Netherlands
  • Liked: 5458
  • Likes Given: 1789
I have to agree with Robotbeat.

This is just another example of NASA's long history of failing to adequately weight the "unknown unknowns" when doing risk assessment.  The risk of some other failure mode being far more likely than expected in new vehicles dwarfs the risk of MMOD.  For NASA to claim otherwise just makes them look foolish.
Emphasis mine.

Minor nit: NASA did not claim this. ASAP did. And although technically ASAP is administered by NASA, ASAP was established by US Congress, and reports to both US Congress and the NASA administrator.
ASAP serves as an independent committee reporting on aerospace safety matters at NASA. It was formed after the not-so-independent NASA-led investigation into the Apollo 1 fire.

So, ASAP's opinion on safety issues (at NASA) does not equate to NASA's opinion on safety issues.
« Last Edit: 08/28/2016 12:17 PM by woods170 »

Offline Oli

  • Senior Member
  • *****
  • Posts: 2240
  • Liked: 425
  • Likes Given: 57

If damage detection doesn't work one could enclose the vehicles in some shielding after docking.

Offline guckyfan

  • Senior Member
  • *****
  • Posts: 6792
  • Germany
  • Liked: 1809
  • Likes Given: 1842

If damage detection doesn't work one could enclose the vehicles in some shielding after docking.

At least impact events should be easily detectable through vibration sensors. Remember how much data they got from that second stage disintegration? Enough to pinpoint the source of the failure. Any detected impact with some level of energy can then trigger a closer inspection.

Offline su27k

  • Full Member
  • ****
  • Posts: 1201
  • Liked: 937
  • Likes Given: 81
So how far off are Dragon and CST-100 from the requested 1 in 270 number?

Seems both are aiming for 1 in 200 without inspection, per http://oiir.hq.nasa.gov/asap/documents/ASAP_4th_Quarterly_Meeting_Minutes_2015.pdf:

Quote
Mr. Justin Kerr provided a briefing on MMOD and reviewed the
current situation. The Agency has a requirement to achieve a Loss of Crew (LOC) risk of no worse than 1 in 270
(1:270) for MMOD. To encourage risk mitigation, the Program has been looking at different ways to approach
that. MMOD is the number one contributor to LOC risk and the primary means by which to close the gap
between where the Program is and where it wants to be. The strategy that is being taken is to back off to 1:200
for the spacecraft themselves, but to require that the design and vehicle capability be the sole means to achieve
that level. Any potential inspections or operational workarounds will be put aside and left for later
consideration. That strategy appears to be working well. Both companies are now looking at potential changes
to their vehicles to address the MMOD risks.

and

Quote
Regarding the MMOD issue, a decision was made to reallocate the protection for MMOD, which required the
providers to focus on the vehicle. Currently, this means that operational procedures must make up the
difference. The good news is that the Program has identified operational changes that can do that, but those
changes are not “free.” NASA has estimated that those changes will cost the equivalent of $10 million per year
until the end of ISS. That begs the question: Can we use other techniques to incentivize the contractors to go
beyond the 1:200 requirement? The Program is hoping that the contractors would do that. Mr. Frost opined that
he would look very carefully at trying to buy some more protection from the equipment.

Online SWGlassPit

  • I break space hardware
  • Full Member
  • ****
  • Posts: 560
  • Liked: 409
  • Likes Given: 61
At least impact events should be easily detectable through vibration sensors. Remember how much data they got from that second stage disintegration? Enough to pinpoint the source of the failure. Any detected impact with some level of energy can then trigger a closer inspection.

No spacecraft to date uses this.  So you spend 500 lbs in wiring, sensors, and avionics to instrument the hell out of a spacecraft to detect strikes.  What do you then do with that information?  If you haven't already designed the spacecraft to survive the most likely strikes, what good did it do you?

The most important MMOD work happens during the design stage, not the operational stage.  You go in with the knowledge that you will sustain a certain number of strikes per unit of time, with a particular distribution of size, velocity, and directionality.  You then design the vehicle to withstand as many of these as you can to meet some one-in-whatever probability of mission success.  If you're going to use up the mass budget, you use it proactively on shielding and survivability, not reactively on detection.

Offline Robotbeat

  • Senior Member
  • *****
  • Posts: 28616
  • Minnesota
  • Liked: 8585
  • Likes Given: 5598
Dragon already contains strain gauges. Getting shot by a bullet should be detectable without 500lbs of wiring.
Chris  Whoever loves correction loves knowledge, but he who hates reproof is stupid.

To the maximum extent practicable, the Federal Government shall plan missions to accommodate the space transportation services capabilities of United States commercial providers. US law http://goo.gl/YZYNt0

Offline guckyfan

  • Senior Member
  • *****
  • Posts: 6792
  • Germany
  • Liked: 1809
  • Likes Given: 1842
At least impact events should be easily detectable through vibration sensors. Remember how much data they got from that second stage disintegration? Enough to pinpoint the source of the failure. Any detected impact with some level of energy can then trigger a closer inspection.

No spacecraft to date uses this. 

And we all know that SpaceX never deviates from what all others have done before them, right?

Edit: sorry but I really, really dislike the argument it has never been done.

Remember that it was said an inspection of the spacecraft for departure would reach the value of 1/270. It would mean they don't depart with that vehicle but wait for a replacement. In the unlikely event of a SpaceStation evacuation they could very likely still use that vehicle, just with reduced safety and redundancy.

A few sensors could reduce that inspection to cases where the spacecraft has actually been hit, not just as a mandatory precaution. The inspection could be performed to find out potential damage at the time of the incident. No need to wait for the planned departure time. So a replacement vehicle could be sent early.
« Last Edit: 08/29/2016 03:57 PM by guckyfan »

Online SWGlassPit

  • I break space hardware
  • Full Member
  • ****
  • Posts: 560
  • Liked: 409
  • Likes Given: 61
Dragon already contains strain gauges. Getting shot by a bullet should be detectable without 500lbs of wiring.
Sure, if you hit really close to a strain gauge and do a lot of damage.  Otherwise, they're useless for this.

No spacecraft to date uses this. 

And we all know that SpaceX never deviates from what all others have done before them, right?

Edit: sorry but I really, really dislike the argument it has never been done.
The fact that it has never been done is important here.  The technology to detect and pinpoint these events, which are blindingly fast and impart little momentum transfer to fully penetrated hardware is not at the level where it could be applied to complex structure and give meaningful data.  Commercial crew is not the place for technology development.  NASA wants high TRL solutions, not science experiments.

Quote
Remember that it was said an inspection of the spacecraft for departure would reach the value of 1/270. It would mean they don't depart with that vehicle but wait for a replacement. In the unlikely event of a Space Station evacuation they could very likely still use that vehicle, just with reduced safety and redundancy.

A few sensors could reduce that inspection to cases where the spacecraft has actually been hit, not just as a mandatory precaution. The inspection could be performed to find out potential damage at the time of the incident. No need to wait for the planned departure time. So a replacement vehicle could be sent early.

Did you read the minutes?  NASA wants the requirement to be met without requiring inspection.

Online abaddon

  • Full Member
  • ****
  • Posts: 1733
  • Liked: 1204
  • Likes Given: 1046
At least impact events should be easily detectable through vibration sensors. Remember how much data they got from that second stage disintegration? Enough to pinpoint the source of the failure. Any detected impact with some level of energy can then trigger a closer inspection.

No spacecraft to date uses this.
Oh?  What about http://research.jsc.nasa.gov/BiennialResearchReport/2009/RASS-4.pdf ?
« Last Edit: 08/29/2016 04:58 PM by abaddon »

Offline Lars-J

  • Senior Member
  • *****
  • Posts: 4429
  • California
  • Liked: 3968
  • Likes Given: 2399
Are you aware that you are talking about the people who actually wrote the book on handling risk in scenarios of uncertainty?

Have you forgotten the Shuttle failure predictions from NASA?

Yeah... They may have written the book on it, but they've also had to rewrite the book so many times due to getting it *wrong*. NASA has a long history of putting thumbs on scales and willful ignorance when it comes to risk handling.

Are they right this time? Time will tell.

Online SWGlassPit

  • I break space hardware
  • Full Member
  • ****
  • Posts: 560
  • Liked: 409
  • Likes Given: 61
At least impact events should be easily detectable through vibration sensors. Remember how much data they got from that second stage disintegration? Enough to pinpoint the source of the failure. Any detected impact with some level of energy can then trigger a closer inspection.

No spacecraft to date uses this.
Oh?  What about http://research.jsc.nasa.gov/BiennialResearchReport/2009/RASS-4.pdf ?

That was used for ascent purposes and was designed to detect strikes of much higher mass and lower velocity and for a much shorter period of time than is being discussed here.  To the extent that it was used on orbit, it was notorious for giving false positives.

That was also 66 accelerometers and their associated wiring and data handling hardware for just one small part of the outer mold line of the vehicle.  It does not scale nicely.  You would need hundreds of sensors, wiring to read data from them, hardware to make sense of that data, and power to make it all work.  When the point of the requirement is to make the vehicle safer, your mass budget is much better spent making the vehicle itself less vulnerable to damage than it is trying to pinpoint where it did get hit.  These are crew transportation vehicles, not research projects.

Offline Robotbeat

  • Senior Member
  • *****
  • Posts: 28616
  • Minnesota
  • Liked: 8585
  • Likes Given: 5598
Dragon already contains strain gauges. Getting shot by a bullet should be detectable without 500lbs of wiring.
Sure, if you hit really close to a strain gauge and do a lot of damage.  Otherwise, they're useless for this....
If a huge MMOD hit Dragon, enough to fatally damage it, it would ring like a bell, like getting shot be a gun. You would hear it, and sound waves can be (and are) picked up by strain gauges. It may not be precise, but knowing that it happened would be useful info.
Chris  Whoever loves correction loves knowledge, but he who hates reproof is stupid.

To the maximum extent practicable, the Federal Government shall plan missions to accommodate the space transportation services capabilities of United States commercial providers. US law http://goo.gl/YZYNt0

Online SWGlassPit

  • I break space hardware
  • Full Member
  • ****
  • Posts: 560
  • Liked: 409
  • Likes Given: 61
Dragon already contains strain gauges. Getting shot by a bullet should be detectable without 500lbs of wiring.
Sure, if you hit really close to a strain gauge and do a lot of damage.  Otherwise, they're useless for this....
If a huge MMOD hit Dragon, enough to fatally damage it, it would ring like a bell, like getting shot be a gun. You would hear it, and sound waves can be (and are) picked up by strain gauges. It may not be precise, but knowing that it happened would be useful info.

If a huge MMOD (hint: what does the first M stand for?) hit anything attached to station, we would have dozens of ways of knowing it immediately.  Strain gauges offer nothing of value here.

Offline A_M_Swallow

  • Elite Veteran
  • Senior Member
  • *****
  • Posts: 8537
  • South coast of England
  • Liked: 362
  • Likes Given: 157
I suspect that spacecraft will be shielded against strikes up to a certain size and made to detect larger strikes. There is likely to be an overlap between the shield and detection sizes. It may also be particle momentum rather than size that is detected. Weak points such as windows may need additional detectors.

Offline guckyfan

  • Senior Member
  • *****
  • Posts: 6792
  • Germany
  • Liked: 1809
  • Likes Given: 1842
Did you read the minutes?  NASA wants the requirement to be met without requiring inspection.

I got that. Are you saying, NASA won't agree to inspections when they know, there is something wrong? Just insisting it is the sole problem of the contractor? Seriously?

Tags: